Google PCA Practice Test 29 — 15 Questions

Question 1

A company uses Cloud Logging to capture application logs. They need to alert when the number of errors exceeds 100 in a 5-minute window. Which type of alert should they create?

Accepted Answer

Log-based metric with an alerting policy. Log-based metrics allow you to count log entries matching a filter. You can then create a metric and an alerting policy based on that metric. The other options are not suitable: SLO alerts monitor service level objectives, notification channels are destinations, and sinks export logs.

Answer

Notification channel with email integration

Answer

Cloud Logging sink to a Pub/Sub topic

Answer

SLO alerting policy

Question 2

A company uses Cloud Monitoring to track the performance of their application. They want to create an alert that triggers when the 99th percentile latency exceeds 500ms over a rolling 5-minute window. Which type of SLO and alert should they use?

Accepted Answer

Request-based SLO with window-based alert. Request-based SLOs are appropriate for latency metrics; a window-based alert evaluates over a time window. Event-based and time-based are not standard SLO types. The correct combination is request-based SLO with window-based alert.

Answer

Event-based SLO with window-based alert

Answer

Window-based SLO with request-based alert

Answer

Time-based SLO with event-based alert

Question 3

A company has a Cloud SQL for PostgreSQL instance in a single zone. To achieve high availability, they want to ensure automatic failover with zero data loss and minimal downtime. Which configuration should they use?

Accepted Answer

Configure a Cloud SQL regional instance with a failover replica in a different zone. Cloud SQL HA requires a regional instance with a failover replica in a different zone within the same region. This provides automatic failover and synchronous replication to ensure zero data loss. Read replicas are for read scaling, not automatic failover. Cross-region replication does not provide automatic failover.

Answer

Deploy a read replica in the same zone and enable automatic failover

Answer

Enable automatic backups and point-in-time recovery

Answer

Add a cross-region read replica and configure failover manually

Question 4

A team needs to run load tests against their application deployed on GKE to validate performance under peak traffic. They want to simulate 100,000 concurrent users generating HTTP requests. Which tool should they use?

Question 5

Your organization runs a production Cloud SQL for PostgreSQL instance. You need to ensure that if the primary zone fails, the database automatically fails over to a standby with no data loss. Which configuration should you use?

Accepted Answer

Deploy a regional Cloud SQL instance with high availability. Cloud SQL HA with regional instances uses synchronous replication to a standby in a different zone, ensuring zero data loss on automatic failover. Cross-region replication is for disaster recovery, not automatic failover. Point-in-time recovery is for restoration to a specific time, not failover. Read replicas are for read scaling, not automatic failover.

Answer

Enable point-in-time recovery (PITR)

Answer

Configure a cross-region replica

Answer

Create a read replica and promote it on failure

Question 6

A company uses Cloud Spanner in a multi-region configuration. They want to ensure the highest availability with an SLA of 99.999%. Which configuration supports this?

Accepted Answer

Multi-region configuration with three regions. Cloud Spanner multi-region configurations are designed for 99.999% availability. The default multi-region setups (e.g., nam3, eur3) include three regions with automatic failover. A single-region configuration offers 99.99%. Multi-region with two regions does not provide the same SLA.

Answer

Single-region configuration

Answer

Dual-region configuration with read replicas

Answer

Multi-region configuration with two regions

Question 7

A team needs to set up alerting for a production service. They want to receive notifications when the 99th percentile latency exceeds 500ms for 5 minutes. Which two Cloud Monitoring components are required? (Choose two.)

Question 8

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. Recently, they experienced a targeted attack that bypassed Cloud Armor's predefined rules. The attack involved a high rate of legitimate-looking requests from a small set of IPs that made the application unresponsive. The team needs to block the attack quickly without affecting legitimate users. What should they do?

Accepted Answer

Enable Google Cloud Armor Adaptive Protection.. Cloud Armor Adaptive Protection uses machine learning to analyze traffic patterns and automatically create tailored rules to block application-layer DDoS attacks that bypass predefined rules. In this scenario, the attack consists of legitimate-looking requests from a small set of IPs, which Adaptive Protection can detect as anomalous and generate a custom signature to block without manual intervention, preserving access for legitimate users.

Answer

Increase the load balancer's capacity to absorb the attack.

Answer

Configure rate limiting with a threshold based on the normal traffic pattern.

Answer

Add the attacking IPs to a Cloud Armor deny list.

Question 9

Refer to the exhibit. The exhibit shows logs and a metric from a GCE instance that was terminated. The instance was part of a managed instance group. Which diagnostic step should be taken FIRST to prevent recurrence?

Accepted Answer

Review the memory usage metric for the instance prior to termination.. The logs indicate OOM kills, and the disk is nearly full. The most likely cause is a combination of high memory usage and disk filling up (possibly swap or logs). First, check memory usage history to confirm if the instance was under-provisioned.

Answer

Set a disk usage alert to be notified when disk exceeds 90%.

Answer

Increase the disk size of the instance template and redeploy.

Answer

Add a startup script to clear temporary files on boot.

Question 10

Your organization requires all container images deployed to GKE to be signed by an approved authority. Which service enforces that only signed images are allowed to run?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require images to be signed by trusted authorities before they can be deployed on GKE.

Answer

Cloud Asset Inventory

Answer

Artifact Registry

Answer

Container Analysis

Question 11

Which TWO statements are true about Google Cloud VPC networks? (Select exactly 2.)

Accepted Answer

Subnets are regional resources and can span zones.. Google Cloud VPC subnets are regional resources that can span multiple zones within the same region. This allows resources in different zones to use the same subnet without requiring additional routing or VPN configuration, providing high availability and fault tolerance within a region.

Answer

Each VPC network is regional in scope.

Answer

By default, no firewall rules are created in a new VPC.

Answer

VPC Peering supports transitive routing.

Question 12

Refer to the exhibit. A user creates a Cloud SQL for PostgreSQL instance and a Compute Engine VM. The VM cannot connect to the database. What is the most likely cause?

Accepted Answer

The Cloud SQL instance does not have a private IP assigned, but the VM is attempting to connect using the private IP.. The Cloud SQL instance has authorized networks set to 0.0.0.0/0, which allows all IPs. However, the instance has a public IP, and the VM has an external IP. The connection fails with timeout, suggesting that the traffic is not reaching the database. This could be due to the database not having SSL enforced, but that would cause a different error. The most likely cause is that the Cloud SQL instance is not configured to allow connections from the VM's public IP, because authorized networks only apply to connections using the public IP. But the exhibit shows it's set to 0.0.0.0/0, so that should work. Another possibility: the VM is trying to connect to the private IP of the Cloud SQL instance, but the instance does not have a private IP. The exhibit shows '--assign-ip' which assigns a public IP, but does not assign a private IP. The VM might be trying to connect to the private IP, which doesn't exist. However, the error is 'connection timed out', which suggests the client cannot reach the IP. If the client is using the public IP, the firewall on the VM allows egress. The issue could be that the Cloud SQL instance's public IP is not reachable from the VM's network due to VPC firewall rules? But the VM's firewall allows egress to 0.0.0.0/0. The most likely cause is that the Cloud SQL instance does not have a private IP, and the VM is trying to connect via private IP. But the user might be using the correct public IP. Another common issue: the Cloud SQL instance requires SSL, but the client is not using SSL. However, that would give a different error like 'SSL required'. The timeout suggests network connectivity. Given the exhibit, the Cloud SQL instance has only a public IP and authorized networks allow all IPs, so the issue is likely that the VM is trying to connect using the instance's private IP, which doesn't exist. Alternatively, the VM might be in a different VPC and peering is not set up. But the question says 'different VPC'. Since the instance has a public IP, the VM can connect via public IP regardless of VPC. The most plausible answer is that the Cloud SQL instance does not have a private IP, and the user is trying to connect to the private IP. However, the exhibit doesn't show the connection string. Another possibility: the user has not enabled public IP access from the VM's network? No, authorized networks allow all. I think the intended answer is that the Cloud SQL instance does not have a private IP, so the VM, if using private IP, cannot connect. But the question says 'connection fails', so we need to infer. Let me craft options.

Answer

The Cloud SQL instance requires SSL connections, and the client is not using SSL.

Answer

The VM's firewall is blocking egress to port 5432 on the Cloud SQL public IP.

Answer

The authorized networks setting is too permissive; it should be restricted to the VM's public IP.

Question 13

Refer to the exhibit. The HPA is configured to scale based on CPU, but it has not scaled up despite the CPU usage being above the target. Which is the most likely cause?

Accepted Answer

The node pool oauthScopes lack the monitoring scope required for HPA to read metrics.. The node pool uses a service account with devstorage.read_only scope, which does not include the required permissions for the HPA to read metrics. The HPA needs the monitoring scope or a service account with monitoring roles to access CPU metrics.

Answer

The cluster has autoscaling enabled, which may conflict with HPA.

Answer

The HPA target is 80%, but the current CPU is 90% which should trigger scaling; the HPA may be broken.

Answer

The HPA min replicas is 3, so it cannot scale down, but it should scale up.

Question 14

Refer to the exhibit. An engineer deploys this Terraform configuration. After deployment, they can SSH into the VM using its public IP. However, they want to restrict SSH access to only a specific IP range (203.0.113.0/24). What change is required?

Accepted Answer

Change the 'source_ranges' in the firewall rule to ['203.0.113.0/24']. The instance already has the required tag.. The firewall rule 'allow-ssh' currently allows SSH from all IPs (0.0.0.0/0) to instances with tag 'ssh-allowed'. To restrict to a specific IP range, the source_ranges must be updated to ['203.0.113.0/24']. The instance already has the tag 'ssh-allowed', so no change to tags is needed.

Answer

Modify the instance to use a network tag 'restricted-ssh' and update the firewall rule target_tags accordingly.

Answer

Add a new firewall rule with higher priority allowing SSH from 203.0.113.0/24, and keep the existing rule but change its priority to 100.

Answer

Update the 'source_ranges' in the firewall rule to ['203.0.113.0/24'] and remove the 'ssh-allowed' tag from the instance.

Question 15

A company is migrating a monolithic application to Google Cloud and wants to minimize operational overhead for scaling. Which service should they use?

Accepted Answer

App Engine Standard. App Engine Standard is the correct choice because it provides a fully managed, autoscaling platform that abstracts away all infrastructure management, including server configuration, scaling, and load balancing. This minimizes operational overhead for scaling a monolithic application by automatically adjusting resources based on traffic without any manual intervention or cluster management.

Answer

Google Kubernetes Engine

Answer

Cloud Run

Answer

Compute Engine with managed instance groups